Privacy Advocates Condemn SECURE Data Act as Weak Federal Bill That Would Gut State Protections

Breaking: Consumer Privacy Bill Faces Fierce Backlash

A newly released federal privacy bill, the SECURE Data Act, is being dismissed by consumer advocacy groups as a hollow proposal that would roll back existing state protections and fail to give Americans meaningful control over their personal data.

The bill, drafted by House Energy and Commerce Committee Republicans without bipartisan support, would preempt dozens of state privacy laws, including those in California, Colorado, and Virginia. Critics warn it would weaken consumer rights rather than strengthen them.

“This is not a serious piece of privacy legislation,” said Jamie Williams, a staff attorney at the Electronic Frontier Foundation (EFF). “It would wipe out hundreds of state protections while offering only weak federal safeguards.”

Key Flaws Identified by Experts

The bill would allow consumers to access, correct, delete, and port their data—standard rights in modern privacy laws. It also requires consent before processing sensitive data or using data for undisclosed purposes. However, experts say these provisions are undermined by fatal loopholes.

Most troubling, the bill does not include a private right of action, meaning consumers cannot sue companies for violations. Enforcement would rely entirely on the Federal Trade Commission (FTC) and state attorneys general.

“Without the ability to sue, companies have little incentive to comply,” Williams added. “It’s like locking the front door but leaving the windows wide open.”

Weak Opt-Out and Advertising Loopholes

Consumers could opt out of targeted advertising, data sales, and profiling that has legal, employment, or housing effects. But the burden is on individuals to act—companies can continue invasive practices until a user opts out.

Moreover, the bill does not ban behavioral advertising outright. “This bill does nothing to stop the relentless tracking that fuels the data economy,” said Megan Gray, a privacy policy consultant.

Background

Privacy legislation has stalled in Congress for years despite growing public concern over data breaches and corporate surveillance. The SECURE Data Act is the latest Republican-led attempt to create a single national standard.

Proponents argue a federal law would simplify compliance for businesses. But critics note that the bill would preempt stronger state laws under Section 15, which invalidates any state provision that “relates to” the federal act—a broad phrase that could wipe out 21 state consumer privacy laws enacted since 2018.

What This Means

If enacted, the SECURE Data Act would create a federal floor that is lower than existing state standards. States would be barred from passing stronger protections in the future. Consumers in states like California would lose access to tools such as the data broker deletion portal and automatic opt-out signals.

“This isn’t a compromise; it’s a rollback,” said Alvaro Bedoya, a former FTC commissioner. “It would leave Americans more exposed to data abuse than they are today.”

Data Broker Registry – A Small Step

The bill does include a requirement for data brokers—companies whose primary business is selling personal data—to register with the FTC. But experts call it a token gesture.

“Registration without enforcement is just a directory of bad actors,” Gray said. “We need strong rules, not just a list.”

Urgent Call for Action

Privacy advocates are urging lawmakers to reject the SECURE Data Act and instead pursue a bill that includes a private right of action, strong data minimization, and state-saving provisions. The EFF and other groups have launched campaigns to raise awareness.

“Americans deserve real privacy, not this hollow shell,” Williams concluded. “We need to demand better.”

Jump to Key Flaws | Jump to Background | Jump to What This Means